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Application Number 10/057,576 RECEIVED 
Response to Office Action mailed October 2, 2006 CENTRAL FAX CENTER 

AMENDMENTS TO THE CLAIMS DEC 0 1 2006 

This listing of claims will replace all prior versions and listings of claims in the application. 



Listing of Claims: 

Claim 1 (Currently Amended): A method comprising: 

capturing network packets from a network using a plurality of distributed agents 
positioned at different locations within the network; 

communicating the network packets to an analyzer coupled to the network; 

identifying duplicate network packets that were captured by the plurality of agents at the 
different locations; and 

displaying th e duplicat e network paokota or non-duplicate network packets based on the 
identification^ 

comparing timestamps of the duplicate packets: 

selecting one of the duplicate packets as a representative packet based on the comparison : 

and 

displaying the representative packet for the duplicate packets. 
Claim 2 &3 (Canceled), 

Claim 4 (Currently Amended): The method of claim 1 , further comprising: wherein- 
dfoploying the duplioato network pookoto further oomprioos : 

filtering the non-duplicate packets out of the captured network packets based on the 
identification: and 

displaying the duplicate packets bflgfid tfagjjljsnflg. 
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ClaimS (Previously Presented): A method comprising: 

capturing network packets from a network using a plurality of distributed agents 
positioned at different locations within the network; 

communicating the captured network packets to an aggregator coupled to the network; 

and 

aggregating the captured network packets into sets of network packets based on source 
information and destination information for the network packets, 

wherein aggregating the captured network packets comprises sorting the network packets 
based on timestamps of the network packets, assigning the network packets having equal source 
information and equal destination information to a common set, and identifying duplicate packets 
within the sets of network packets that were captured by the plurality of distributed agents at the 
different locations. 

Claim 6 (Canceled), 

Claim 7 (Previously Presented): The method of claim 5, further comprising displaying a 
subset of the network packets based on the identification. 

Claim 8 (Previously Presented): The method of claim 5, wherein identifying duplicate 
packets comprises: 

identifying network packets having equal sequence numbers and acknowledgement 
numbers; and 

performing a byte-by-byte comparison for payloads of the identified packets. 

Claim 9 (Original): The method of claim 5, wherein the source information comprises one of a 
media access control (MAC) address and a Data Link Control (DLC) address for a source 
network device. 
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Claim 10 (Original): The method of claim 5, wherein the destination information comprises one 
of a media access control (MAC) address and a Data Link Control (DLC) address for a 
destination network device. 

Claim 1 1 (Previously Presented): The method of claim 5, further comprising displaying non- 
duplicate packets of one of the sets of network packets. 

Claim 12 (Previously Presented): The method of claim 1 1, wherein displaying non-duplicate 
packets comprises displaying a representative packet for the duplicate packets. 

Claim 13 (Original): The method of claim 1 1, wherein displaying a representative packet 
comprises: 

comparing timestamps of the duplicate packets, and 
displaying one of the packets based on the comparison. 

Claim 1 4 (Previously Presented): A method comprising: 

capturing network packets from a network using a plurality of distributed agents 
positioned at different locations within the network; 

communicating the captured network packets to an aggregator coupled to the network; 

aggregating the captured network packets into sets of network packets based on source 
information and destination information for the network packets; 

graphically illustrating the sets of aggregated network packets; 

selecting one of the sets of aggregated network packets in response to user input; and 

displaying the packets of the selected set by identifying duplicate packets within the sets 
of network packets that were captured by the plurality of distributed agents at the different 
locations, and displaying non-duplicate packets of the selected set. 

Claim 15 & 16 (Canceled). 
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Claim 1 7 (Previously Presented): The method of claim 1 4, further comprising displaying a 
representative packet for the duplicate packets. 

Claim 1 8 (Original): The method of claim 1 7, wherein displaying a representative packet 
comprises: 

comparing timestamps of the duplicate packets, and 
displaying one of the packets based on the comparison. 

Claim 19 (Previously Presented): The method of claim 1 7, further comprising displaying a 
remainder of the duplicate packets not selected to be the representative packet in response to user 
input 

Claim 20 (Previously Presented): The method of claim 1 7, further comprising: 

displaying an expandable graphical icon proximate the representative packet for the 

duplicate packets; and 

displaying a remainder of the duplicate packets based on user input selecting the 

expandable graphical icon. 

Claim 21 (Original): The method of claim 1 4, wherein capturing network packets comprises 
communicating start and stop commands from the aggregator to the agents. 
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Claim 22 (Currently Amended): A system comprising: 

a plurality of distributed agents positioned at 'different locations within a network to 
capture packets from the network, wherein the agents assign the captured packets timestamps: 

an aggregation module coupled to the network to receive the captured packets, wherein 
the aggregation module identifies duplicate packets that were captured by the plurality of 
distributed agents at the different location s, compares the timestamps of the duplicate packets, 
and selects one of the duplicate packets as a representative packet based on the comparison; and 

a display coupled to the aggregation module, wherein the aggregation module presents 
non-duplicate network packets and a the selected representative packet for the duplicate packets 
on the display. 

Claim 23 & 24 (Canceled). 

Claim 25 (Previously Presented): The system of claim 22, wherein the aggregation module 
presents a remainder of the duplicate packets not selected to be the representative packet on the 
display in response to user input selecting the representative packet. 

Claim 26 (Original): The system of claim 22, wherein the aggregation module identifies 
duplicate packets by identifying packets having equal sequence numbers and acknowledgement 
numbers, and by performing a byte-by-byte comparison for payloads of the identified packets. 

Claim 27 (Original): The system of claim 22, wherein the aggregation module assigns the 
captured packets into sets of packets based on source information and destination information for 
the packets. 

Claim 28 (Original): The system of claim 22, wherein the agents assign the captured packets 
timestamps and the aggregation module sorts the packets based on timestamps, and further 
wherein the aggregation module assigns the packets having equal source information and equal 
destination information to a common set of packets. 
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Claim 29 (Original): The system of claim 28, wherein the source information comprises one of 
a media access control (MAC) address and a Data Link Control (DLC) address for a source 
network device. 

Claim 30 (Original): The system of claim 28, wherein the destination information comprises 
one of a media access control (MAC) address and a Data Lick Control (DLC) address for a 
destination network device. 

Claim 31 (Original): The system of claim 22 ? further comprising a controller that maintains a 
communication link with each of the agents, wherein the controller issues commands to the 
agents via the communication link to initiate and terminate data capture by the agents. 

Claim 32 (Currently Amended): A computer-readable medium comprising instructions to 
cause a processor to: . 

direct a plurality of distributed agents positioned at different locations within a network to 
capture packets from the network; 

receive the captured packets with an analyzer coupled to the network; 

identify one or more sets of duplicate network packets that were captured by the plurality 
of agents at the different locations; 

display non-duplicate network packets; 

compare dmestamns of the duplicate packets within each of the sets of duplicate packets: 
select one of the duplicate packets within each of the sets of duplicate packets as a 
representative packet of each of the sets of duplicate packets based on the comparison; and 

display a the selected representative packet for each set of the sets of duplicate packets. 

Claim 33 (Canceled). 
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Claim 34 (Previously Presented): The medium of claim 32, further comprising instructions to 
cause the processor to: 

identify network packets having equal sequence numbers and acknowledgement numbers 
as duplicate packets; and 

perform a byte-by-byte comparison for payloads of the identified packets- 
Claim 35 (Original): The medium of claim 32, further comprising instructions to cause the 
processor to aggregate the captured network packets into sets of network packets based on source 
information and destination information for the network packets. 

Claim 36 (Previously Presented): The medium of claim 35, further comprising instructions to 
cause the processor to sort the network packets based on timestamps of the network packets, 
assign the network packets having equal source information and equal destination information to 
a common set, and identify duplicate packets within the sets of network packets that were 
captured by the plurality of agents at the different locations. 

Claim 37 (Previously Presented): The medium of claim 35, further comprising instructions to 
cause the processor to graphically illustrate the sets of aggregated network packets. 

Claim 38 (Previously Presented): The medium of claim 37, further comprising instructions to 
cause the processor to: 

select one of the sets of aggregated network packets in response to user input; and 

display the packets of the selected set. 
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